The corridor receipt

Every corridor crossing produces a receipt. The receipt is the atomic unit of the evidence chain: one crossing, one record, one cryptographic commitment.

A receipt carries the information you would expect: which corridor was crossed, in what direction, when, its sequence number in the chain it extends, what state the entity was in before the crossing and after, which regulatory packs – the versioned, machine-readable rule sets each jurisdiction publishes – governed the transition, and which compliance evaluations were performed. Three further fields are about the chain rather than the crossing.

The predecessor root ties the receipt to everything that came before: it must equal the previous receipt’s next root. The next root is the digest of this receipt’s own canonical content, computed by the commitment function below; because that content includes the entity’s post-crossing state, one digest serves as both the chain link and the commitment to the state the crossing produced. The accumulator root commits to the chain’s entire history before this receipt; its role is explained with the Merkle Mountain Range below.

The commitment function – the function that computes the next root from the receipt’s content – must be deterministic and canonical. Two systems processing the same receipt must produce the same digest. Determinism fails by default when the receipt contains sets (which have no canonical ordering), timestamps (which have multiple valid representations), and optional fields (whose absence can be encoded in more than one way). Canonical serialization removes every such ambiguity. The JSON Canonicalization Scheme (RFC 8785) fixes the encoding – object keys sorted, one form for each number and string – and deliberately preserves array order and leaves timestamps and optional fields to the application. The receipt schema fixes those three: sets are deduplicated and lexicographically sorted before they are encoded as arrays, timestamps are normalized to a fixed format, and optional fields follow a documented convention. The receipt is serialized into canonical bytes and hashed with SHA-256 (FIPS 180-4).

Two fields are excluded from the digest. The proof field carries the material that authenticates the content – the appender’s signature, and auxiliary verification artifacts such as inclusion paths and folding material – and what authenticates the content cannot sit inside it: the signature is computed over the next root, so it cannot be under the digest it signs. The next root itself is excluded because a receipt cannot contain its own hash – finding bytes that contain their own SHA-256 digest is computationally infeasible. Everything else goes in.

Each receipt is signed at its append. Each endpoint of a corridor keeps its own chain of the crossings its kernel records, so a chain belongs to one zone: its kernel records the crossing, appends the receipt in the atomic step of the next section, and signs the next root, and the signature travels in the proof field. That zone is the chain’s operator, the name the rest of the paper uses for it. A chain is identified by its corridor and its operator, and the sections below treat one chain. The chain invariants below make a bad append detectable; the signature makes it attributable. A broken link is then not an anomaly in a database but evidence against the operator’s key, which is the difference between noticing a lie and proving one.

The append rule

A receipt chain is an ordered, gap-free, hash-linked sequence with three invariants enforced on every append.

First, sequence numbers are gap-free. Receipt n must carry sequence number n. You cannot skip a receipt. You cannot insert one out of order. If the chain has twelve receipts and you try to append one with sequence number 14, the append is rejected.

Second, linkage to the current state is exact. The new receipt’s predecessor root must equal the chain’s current head, and its accumulator root must equal the accumulator’s current root. If either fails, the receipt is claiming to extend a chain state that does not match reality: it was computed against stale state, or someone is trying to fork the chain.

Third, commitment integrity holds. The new receipt’s next root must equal the commitment function applied to its content. If it does not, the receipt was corrupted in transit or modified after commitment.

Only after all three checks pass does the chain advance: the head moves to the new receipt’s next root, the receipt joins the sequence, and its next root is pushed into the accumulator. The checks and the advance are one atomic step. Appends are serialized per chain and the head moves by compare-and-swap, so a receipt computed against a head that has since moved fails the linkage check and is re-derived against the new head; two appends never interleave.

This is a fail-closed system. A receipt that fails any check is rejected entirely. There is no partial acceptance, no “append but flag for review,” no deferred validation. The chain either maintains its invariants or refuses to grow, and that refusal is what preserves its evidentiary value.

Why a hash chain is not enough

A hash chain answers one question well: has any entry been modified since it was committed? Walk the chain from the head backward, recomputing digests at each step. If every computed digest matches, the chain is intact; any mismatch is tampering.

Other questions it answers badly. Was this specific receipt included? – a linear scan of the chain. Was this receipt committed before that one? – the same scan. For a corridor with thousands of crossings, questions about single receipts should not cost the whole chain.

A Merkle Mountain Range answers them in logarithmic time. The MMR is an append-only accumulator (Todd, 2012; Bünz et al., 2020). Every append pushes the receipt’s next root as the next leaf, so a receipt’s leaf index equals its sequence number. The MMR maintains a set of perfect binary trees – the peaks – that together commit to all leaves. To prove that a receipt is included, produce the Merkle path from its leaf to its peak plus the set of peaks; the verifier recomputes the path, bags the peaks, and checks the result against the MMR root. And because leaf order is append order, two inclusion proofs also settle precedence: the receipt at the lower index was committed first.

The MMR’s hashing is domain-separated: leaf digests are computed over bytes prefixed with one constant, internal nodes with another – the discipline of Certificate Transparency (RFC 6962), which keeps append-only Merkle logs of the web’s certificate issuance. Without it, an attacker could construct a payload that is simultaneously a valid leaf and a valid internal node, and lead the verifier to accept a proof for content that was never appended.

An inclusion proof is only as strong as the root it verifies against, and this is where the receipt’s accumulator root field earns its place. A verifier who skips the chain walk must obtain the MMR root from an authenticated source; otherwise the operator serves a substitute root and proves inclusion of anything. So each receipt’s hashed content includes the MMR root over all receipts before it. An authenticated head therefore authenticates the accumulator over the entire prior history – the one entry the committed root does not cover is the head itself, which the verifier holds directly. However the head is authenticated – the operator’s signature makes it the operator’s attributable statement, and the watcher quorum of the next section makes it a head a party may act on – the root inherits that authentication, and inclusion proofs verify against it with no walk.

The chain and the MMR answer different questions. The chain answers: what is the committed history? The head commits to all of it. The MMR answers: is this receipt in that history, and where? A system needs both – the chain for tamper-evident sequence, the MMR for efficient point queries against it.

Fork detection

Hash chains have a well-known vulnerability: equivocation. A malicious chain operator can maintain two chains that diverge from a common ancestor, presenting one version to one party and a different version to another. Both chains are internally valid – correct hash links, correct sequence numbers, correct commitments. They simply disagree about what happened after the fork point.

The signatures of the previous sections already convict an equivocating operator, given both views. A gap-free chain has exactly one receipt at each sequence number, and the operator signs only at the append, so two receipts of one chain – the same corridor, signed under the same operator’s key – with the same sequence number and distinct digests are, for any party holding both, a self-contained and attributable proof that the operator signed two histories; no quorum strengthens it, and no honest operator can produce such a pair. What signatures alone do not supply is the collision. An operator that serves one history to each party and both to nobody is never caught by any party’s local check, and the damage is done in the interval before the views meet. Watchers exist to make views collide systematically and within bounded time. The companion Sovereign Jurisdiction Network paper specifies the watcher layer in full; this section states what the receipt chain requires of it.

A corridor admits a finite set W of watchers, fixed by the corridor’s registration policy. Each watcher holds a registered Ed25519 key (Bernstein et al., 2012). Two kinds of bond stand behind the corridor, both held by its bond custodian, an escrow agent outside either endpoint’s unilateral control: the operator posts the bond the corridor instrument requires of its endpoints, and each watcher posts a bond at registration. Both are slashable on proven equivocation, and slashing follows an accepted proof through the custodian, never the detector’s output alone. A watcher observes a chain’s growth, reading each receipt as it is appended and verifying the operator’s signature over it; it attests only heads that verify, and signs each attestation over five values: the chain identifier, which names the corridor and the operator whose chain it is; the observed head’s digest and sequence number; the watcher’s local timestamp; and the corridor epoch, the monotone period counter the corridor protocol advances. The digest already commits to the sequence number; the attestation carries it in the clear so that the predicate below is decidable from attestations alone.

Attestations are collected per corridor epoch, and the epoch bounds collection latency and nothing else: an attestation whose timestamp falls outside the epoch it names by more than the corridor’s configured clock-skew tolerance is discarded; the tolerance is a deployment parameter, set to five minutes in the reference profile. A watcher attests at most one head per sequence number of a chain. Honest observation never yields two, since the chain has one receipt at each height, and a watcher that is itself served two heads at one height, both under the operator’s signature, holds the operator’s equivocation proof and files that instead. A key that signs two distinct digests at one sequence number of one chain is therefore itself equivocating: both its attestations are discarded from every count, and its bond is slashed.

A fork is declared when a chain’s attestation record, read whole and not by epoch, contains two distinct head digests at the same sequence number, each backed by at least \theta attestations from distinct watchers, where \theta is a corridor parameter bounded below by \lceil |W|/3 \rceil + 1. Equal height is what makes the predicate decidable and honest growth harmless: the head moves with every append, so the record carries many distinct digests at many heights, and distinct digests at distinct heights say nothing; two at one height are two histories. The whole record is what closes a rewind: a branch served late gathers its \theta attestations at height h in an epoch after the genuine head at h gathered its own, and a predicate read within one epoch would find no collision and admit both heads under the reliance rule below. The predicate is a function of the attestation set alone, so every party holding the same attestations reaches the same verdict, in whatever order they arrived. The bound is quorum arithmetic. Assume at most f = \lceil |W|/3 \rceil watchers are faulty. Any f + 1 attestations from distinct watchers then include at least one honest watcher, so a digest reaching \theta was genuinely served, under the operator’s signature, to an honest observer – and two such digests at one height prove that the operator signed conflicting heads. An honest watcher in each quorum holds the signed receipt it verified, so the two quorums between them hold the signature pair of the previous paragraph, which convicts without the fault bound.

Detection produces evidence, not a verdict about which branch is genuine. The protocol does not select a winner; any rule that did would hand branch selection to whoever can influence the inputs it selects on. The two quorum-backed attestation sets – one chain, one sequence number, two digests, at least \theta distinct watcher signatures behind each – are a signed proof of equivocation that a verifier checks from the attestations alone, under the fault bound: grounds to slash the operator’s bond, to suspend or demote the corridor, and for counterparties, regulators, and courts to act. Which branch, if either, reflects the crossings that actually occurred is then a question about the underlying transactions, answered by the receipts and the parties to them. The fork proof establishes that the operator lied; everything after that is ordinary adjudication over authenticated records.

The scheme has three boundaries, all set by \theta. Suppression: detection fails when more than |W| - \theta watchers collude with the operator, since fewer than \theta honest watchers remain and the head served to honest observers can never gather a quorum. Framing: \theta colluding watchers can attest a digest the operator never signed, at a height the genuine head also reaches, and so fabricate a fork proof against an honest operator; at |W| = 10 with \theta at its floor of five, framing takes five watchers where suppression takes six. Detection and its soundness both rest on the fault bound f: suppression takes |W| - \theta + 1 colluders and framing takes \theta, so with \theta set in the window f + 1 \le \theta \le |W| - f both need more than f colluders, and each breaks the bound in its own direction, one hiding a fork and one manufacturing it. Partition: an operator that serves a substitute head to fewer than \theta watchers and to a counterparty raises no quorum for it and so no fork. The substitute is defeated by the reliance rule – a party acts on a head backed by \theta attestations and on nothing weaker – which leaves an unbacked head as the operator’s bare word. Bonds price proven equivocation and nothing else: the operator’s is forfeit on a fork proof, a watcher’s on two attestations at one height of one chain. Silent collusion – watchers that withhold attestations of the head served to honest observers, or attest the substitute head alone – violates no slashing condition stated here, and the bond does not price it. Against it the only mitigation is diversity: watchers operated by parties with misaligned incentives, such as the corridor partner, the operator’s regulator, and independent auditors. This is the known boundary of accountability by observation (Haeberlen, Kouznetsov, and Druschel, 2007), and the companion paper examines what watcher independence can and cannot be made to mean.

Content-addressed asset identity

One question remains: what exactly is crossing the corridor?

A smart asset – a digitally represented economic instrument whose lifecycle is governed by the compliance rules of the jurisdictions it touches – needs an identity. The identity cannot be a database key, because database keys are local to a single system. It cannot be a URL, because URLs change. It cannot be assigned by an authority, because authority-assigned identifiers depend on the authority’s continued operation and good behavior.

Content addressing meets all three constraints: the asset’s identity is the digest of its genesis record. The genesis record fixes the asset’s origin – the creator, identified by a public key rather than an entry in anyone’s registry; the jurisdiction of creation; the instrument’s metadata; the creation time; and a creator-chosen nonce. None of this changes after creation. By collision resistance, distinct genesis records yield distinct identifiers, and the nonce makes intended-distinct assets distinct records: a creator issuing a batch of otherwise-identical instruments in the same instant separates them by nonce. The identifier carries an algorithm tag alongside the digest, so the hash function can be replaced without invalidating existing identifiers – the scheme of the companion Content-Addressed Identity paper, which also treats the one thing the identifier deliberately does not establish: that the genesis record corresponds to a creation act some sovereign recognizes. That is supplied by attestation, and attestations bind to the digest.

This is the principle behind content-addressable storage in IPFS and git: the identity of an object is derived from its content, not assigned by a registry. Two systems that independently compute the genesis digest of the same asset arrive at the same identifier, with no coordination and no registry lookup. The identifier is a deterministic function of the thing it identifies.

Content identity is not overloaded with policy meaning. The genesis digest tells you where the asset came from. It does not tell you whether the asset is compliant, whether it can be transferred, or what rules govern its behavior. Those questions are answered by the compliance evaluation that runs at each corridor crossing – which is exactly what the receipt chain records.

The layered proof stack

The full system makes five distinct proof claims, each answered by a different mechanism.

Transition commitment: “this receipt’s digest is a deterministic function of its content.” Answered by the canonical commitment function.

Ordered append: “this receipt extends the chain’s current head, in sequence, without gaps.” Answered by the three-invariant append rule.

Inclusion and order: “this receipt is in the committed history, at this position.” Answered by an MMR inclusion proof against an authenticated head.

Equivocation evidence: “the operator signed two histories.” Answered by two operator-signed receipts of one chain at one sequence number with distinct digests, or by two quorum-backed watcher attestation sets at one sequence number drawn from one chain’s whole attestation record.

Verification without the data: “this chain is well-formed, checkable by a verifier who holds an attested head and nothing else.” This is the one claim whose mechanism is a design target rather than a delivered component; its honest statement follows.

The claims are deliberately not conflated. A system that collapsed them into a single “the chain is valid” check would be harder to audit, because every failure would be ambiguous among commitment, sequencing, inclusion, attestation, and folding. Separated, each failure has a precise diagnosis.

The target deserves precision because the obvious motivation for it is wrong. Walking a chain of n receipts costs O(n) hashes, and hashing is fast: SHA-256 streams at gigabytes per second on commodity hardware; a million receipts of ten kilobytes each are ten gigabytes, and a verifier holding them walks them in seconds. Computation is not the constraint; possession is. The walk requires the complete receipt data, and the parties with the strongest need to verify – the corridor counterparty, a regulator, a court – cannot be assumed to hold every receipt, or to be entitled to hold them, since receipts carry state that does not all cross jurisdictional boundaries. What is wanted is a proof that the chain is well-formed that travels without the chain.

The intended mechanism is incrementally verifiable computation built on a folding scheme (Kothapalli, Setty, and Tzialla, 2022). Fix the step relation F, which holds at step i exactly when the receipt’s sequence number is i, its predecessor root equals the previous receipt’s next root, its next root equals the commitment function applied to its canonical content, and its accumulator root correctly extends the previous receipt’s. A folding scheme reduces checking two claimed executions of F to checking one, so a prover maintains a running instance that accumulates the whole chain, folding each receipt in as it is appended. The running instance does not grow as the chain does, and the final proof – after a compression step, which is also where zero knowledge enters if it is wanted – has size and verification cost governed by the circuit for F, not by n.

The relation fixes what is proved, and two versions differ by orders of magnitude in proving cost. With F as stated, the proof establishes that the chain is well-formed: correctly sequenced, correctly linked, correctly committed. It does not establish that the compliance evaluations recorded in the receipts were correctly computed; for that, the evaluation itself – the per-domain verdict computation the companion How Compliance Composes paper specifies – must move inside F. What the construction delivers now is the O(n) walk for a verifier who holds the data and the O(\log n) inclusion proof for one who holds an authenticated head. The folded chain proof is contingent on fixing F’s circuit and on the soundness of the folding backend, and the construction claims nothing stronger until both are discharged.

Why this structure matters

The receipt chain is not a novel cryptographic construction. Hash chains are decades old (Haber and Stornetta, 1991). Merkle trees are decades old (Merkle, 1987). Content addressing and Ed25519 signatures are well understood. The individual components are not the contribution.

The contribution is the application: a layered construction where each layer answers a specific question about cross-jurisdictional evidence, and the layers compose into an auditable proof stack for corridor crossings. The receipt records what happened, under signature. The chain fixes the order. The MMR makes point queries cheap. The watchers bring the two views of an equivocation together within bounded time, where the operator’s signatures make it attributable and the bonds make it slashable. The folding scheme is the route to verification without the data, once its proof obligations are discharged. The content-addressed genesis identity anchors the assets being transferred.

Each layer has its own failure surface, its own verification rule, and its own threat model. When something goes wrong – and in a system that processes millions of corridor crossings, something will go wrong – the layered structure tells you exactly where to look. Was the receipt malformed? Was the chain order violated? Was a receipt omitted from the accumulator? Did a key sign two heads at one height? Did a fold fail to verify?

This diagnostic precision is a requirement for any evidence chain that courts, regulators, and counterparties will rely on. An opaque “verification failed” is useless. “The predecessor linkage broke between receipts 4,271 and 4,272, and here is the signature over the bad append” is actionable.

The core requirement is two sentences: every corridor crossing must produce a receipt, and every receipt must link to the one before. Everything else – the MMR, the watchers, the folding scheme, the content addressing – is infrastructure that makes those two sentences verifiable, attributable, and practical at scale.

References

Bernstein, D. J., Duif, N., Lange, T., Schwabe, P., and Yang, B.-Y. High-Speed High-Security Signatures. Journal of Cryptographic Engineering, 2(2):77-89, 2012.

Bünz, B., Kiffer, L., Luu, L., and Zamani, M. FlyClient: Super-Light Clients for Cryptocurrencies. In Proceedings of the IEEE Symposium on Security and Privacy (S&P), 2020.

Haber, S. and Stornetta, W. S. How to Time-Stamp a Digital Document. Journal of Cryptology, 3(2):99-111, 1991.

Haeberlen, A., Kouznetsov, P., and Druschel, P. PeerReview: Practical Accountability for Distributed Systems. In Proceedings of the ACM SIGOPS Symposium on Operating Systems Principles (SOSP), 2007.

Kothapalli, A., Setty, S., and Tzialla, I. Nova: Recursive Zero-Knowledge Arguments from Folding Schemes. In Advances in Cryptology (CRYPTO), LNCS 13510, Springer, 2022.

Laurie, B., Langley, A., and Kasper, E. Certificate Transparency. RFC 6962, Internet Engineering Task Force, 2013.

Merkle, R. C. A Digital Signature Based on a Conventional Encryption Function. In Advances in Cryptology (CRYPTO), LNCS 293, Springer, 1987.

National Institute of Standards and Technology. Secure Hash Standard (SHS). FIPS PUB 180-4, 2015.

Rundgren, A., Jordan, B., and Erdtman, S. JSON Canonicalization Scheme (JCS). RFC 8785, Internet Engineering Task Force, 2020.

Todd, P. Merkle Mountain Ranges. OpenTimestamps documentation, 2012.